[vlc-commits] androidsurface: fix double free on error

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Sun Jul 14 19:21:57 2013 +0300| [ffcfa6daa7b0dbd66a8474b9c247e7b238531f07] | committer: Rémi Denis-Courmont

androidsurface: fix double free on error

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=ffcfa6daa7b0dbd66a8474b9c247e7b238531f07
---

 modules/video_output/androidsurface.c |   15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/modules/video_output/androidsurface.c b/modules/video_output/androidsurface.c
index 6784ab9..4464394 100644
--- a/modules/video_output/androidsurface.c
+++ b/modules/video_output/androidsurface.c
@@ -224,11 +224,13 @@ static int Open(vlc_object_t *p_this)
     msg_Dbg(vd, "Pixel format %4.4s", (char*)&fmt.i_chroma);
 
     /* Create the associated picture */
-    picture_resource_t *rsc = &sys->resource;
-    rsc->p_sys = malloc(sizeof(*rsc->p_sys));
-    if (!rsc->p_sys)
+    picture_sys_t picsys = malloc(sizeof(*picsys));
+    if (unlikely(picsys == NULL))
         goto enomem;
-    rsc->p_sys->sys = sys;
+    picsys->sys = sys;
+
+    picture_resource_t *rsc = &sys->resource;
+    rsc->p_sys = picsys;
 
     for (int i = 0; i < PICTURE_PLANE_MAX; i++) {
         rsc->p[i].p_pixels = NULL;
@@ -236,8 +238,10 @@ static int Open(vlc_object_t *p_this)
         rsc->p[i].i_lines = 0;
     }
     picture_t *picture = picture_NewFromResource(&fmt, rsc);
-    if (!picture)
+    if (!picture) {
+        free(picsys);
         goto enomem;
+    }
 
     /* Wrap it into a picture pool */
     picture_pool_configuration_t pool_cfg;
@@ -271,7 +275,6 @@ static int Open(vlc_object_t *p_this)
     return VLC_SUCCESS;
 
 enomem:
-    free(rsc->p_sys);
     dlclose(sys->p_library);
     free(sys);
     vlc_mutex_unlock(&single_instance);